Signature Detail

TROJAN: ngrBot IRC Command and Control Activity

This signature detects the IRC Command and Control activity of the ngrBot, a malicious trojan. Users infected by this trojan can have their web traffic redirected and intercepted, which could lead to an exposure of sensitive data, like banking information. This trojan also has the ability to erase the boot sector of the hard drive, resulting in an unusable system. The source IP is infected and should be removed from the network for forensic analysis and malware removal.

References

• URL: http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Ngrbot-I.aspx